The COSO framework (Internal Control, Integrated Framework, first issued in 1992 and updated in 2013) is the most widely used model for internal control. It has five components: control environment, risk assessment, control activities, information and communication, and monitoring activities, supported by 17 principles.
Source: COSO, Internal Control. Originally issued in 1992 and refreshed in 2013.
The five components and 17 principles
| Component | Principles (summarised) |
|---|---|
| Control environment | 1 Commitment to integrity and ethical values. 2 Board independence and oversight. 3 Structures, reporting lines and authorities. 4 Commitment to competence. 5 Holding people accountable. |
| Risk assessment | 6 Clear objectives. 7 Identify and analyse risks. 8 Assess fraud risk. 9 Identify and assess significant change. |
| Control activities | 10 Select and develop control activities. 11 General controls over technology. 12 Deploy through policies and procedures. |
| Information and communication | 13 Use relevant, quality information. 14 Communicate internally. 15 Communicate externally. |
| Monitoring activities | 16 Ongoing and separate evaluations. 17 Evaluate and communicate deficiencies. |
The framework applies these components to three categories of objectives: operations, reporting and compliance, at every level of the organisation.
COSO ERM (2017): enterprise risk management
COSO's enterprise risk management framework was first issued in 2004 and revised in 2017 as Enterprise Risk Management: Integrating with Strategy and Performance. It has five components and 20 principles:
| Component | Focus |
|---|---|
| Governance and culture | Board risk oversight, culture and values |
| Strategy and objective-setting | Risk appetite and how risk shapes strategy |
| Performance | Identifying, assessing, prioritising and responding to risks |
| Review and revision | Reviewing performance and changing the approach |
| Information, communication and reporting | Sharing risk information across the organisation |
COSO in ACCA SBL
Internal control and audit is syllabus area F, and risk is area D. Use COSO as a checklist when a case describes a control failure, fraud or weak governance:
- Identify the failure in the case (for example, unauthorised payments).
- Name the COSO component that failed (control activities: no authorisation; control environment: tone at the top).
- Explain the consequence for the organisation.
- Recommend specific controls and who should own them, such as the audit committee or internal audit.
Worked example
If a charity like Historic Places (March 2025 pre-seen) suffered a data breach of donor records, a COSO analysis would point to weak general IT controls (principle 11), poor risk assessment of cyber threats (principle 7) and weak monitoring (principles 16 and 17). Recommendations: an IT security review, staff training, access controls, regular internal audit of IT and reporting to the audit committee.
Advantages and limitations
Advantages
- Widely recognised, so auditors, boards and regulators share a common language
- Covers culture and tone at the top, not just procedures
- Works for organisations of any size
Limitations
- Can feel complex and bureaucratic for small organisations
- A framework, not a guarantee: controls can be overridden by management or collusion
- Needs judgement to apply proportionately
FAQs
What is the COSO framework?
The Internal Control, Integrated Framework from the Committee of Sponsoring Organizations of the Treadway Commission (COSO). It was first issued in 1992 and updated in 2013, and it is the most widely used framework for designing and assessing internal control.
What are the 5 components of COSO?
Control environment, risk assessment, control activities, information and communication, and monitoring activities.
How many principles are in the COSO framework?
The 2013 internal control framework has 17 principles spread across the five components. The 2017 COSO ERM framework has 20 principles.
What is the difference between COSO internal control and COSO ERM?
The internal control framework covers controls over operations, reporting and compliance. COSO ERM (2004, updated 2017 as 'Integrating with Strategy and Performance') is broader, covering how risk is managed alongside strategy and performance.
What does COSO stand for?
The Committee of Sponsoring Organizations of the Treadway Commission.